{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-05T13:52:51.873","vulnerabilities":[{"cve":{"id":"CVE-2025-49147","sourceIdentifier":"security-advisories@github.com","published":"2025-06-24T18:15:25.247","lastModified":"2025-09-22T13:53:38.260","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request to an anonymously authenticated endpoint it's possible to retrieve information about the configured password requirements. The information available is limited but would perhaps give some additional detail useful for someone attempting to brute force derive a user's password. This information was not exposed in Umbraco 7 or 8, nor in 14 or higher versions. The vulnerability is patched in versions 10.8.11 and 13.9.2."},{"lang":"es","value":"Umbraco, un sistema de gestión de contenido .NET gratuito y de código abierto, presenta una vulnerabilidad en las versiones 10.0.0 a 10.8.10 y 13.0.0 a 13.9.1. Mediante una solicitud a un endpoint autenticado anónimamente, es posible obtener información sobre los requisitos de contraseña configurados. La información disponible es limitada, pero podría proporcionar información adicional útil para quienes intenten obtener la contraseña de un usuario mediante fuerza bruta. Esta información no se expuso en Umbraco 7 ni 8, ni en la versión 14 o posteriores. La vulnerabilidad está corregida en las versiones 10.8.11 y 13.9.2."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.8.11","matchCriteriaId":"82E06128-A359-4BF5-90B5-5A2283066F21"},{"vulnerable":true,"criteria":"cpe:2.3:a:umbraco:umbraco_cms:*:*:*:*:*:*:*:*","versionStartIncluding":"13.0.0","versionEndExcluding":"13.9.2","matchCriteriaId":"16DFCAF2-D009-4583-83B5-FFEF85A510E6"}]}]}],"references":[{"url":"https://github.com/umbraco/Umbraco-CMS/commit/b4144564c836ec6929111ce2a12eb1f67b42d61e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/umbraco/Umbraco-CMS/commit/d8f68d2c40f8e158bd81d469f25ef3a4e1d86c4c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-pgvc-6h2p-q4f6","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]}]}}]}